Zone Alarm Fire wall new questions.

[evilfantasy]

If you folk's live in America, please enjoy a Happy Thanks Giving.

Thanks 

Open CCleaner and select the Applications tab. Look down the list under Multimedia and uncheck Windows Media Player. CCleaner "should" leave it alone when you run it.

[tpolcha]

I plan to reinstall (any recommendations); Spybot S&D, LavaSoft AdAware, AVG's Spyware and Rootkit. 

Should they be installed first or after I install Ccleaner?

[evilfantasy]

Any order should be fine.

I would suggest using the free Panda Antirootkit instead of AVG AntiRootkit.

Here is the zip file for it if you want it. Panda Rootkit.zip

Unzip it and run the PAVARK.exe file.

Tick the box that says In depth scan and follow the on screen instructions.

Also check out WinPatrol 2007 which is a security monitor. Has a lot of other useful tools in it as well. Don't download the WinPatrol Plus, it is a paid version but the 2007 is free.

[Broni]

Thank you. We'll

[tpolcha]

Everything is cleaned up, F/W is installed and running well, and the AVG/ A/V began working as advertised getting its updates.  I did an update on the a/v yesterday and it came up with this item:
C:\Windows\sys32\drivers\etc\hosts

Error: 0
Results = Change
Status  = Changed

Next scan had no activity at all.

Next and every subsequent scan the same item returns.

How do I go about determining what it is so I can correct it?

Thanks again,  Tom

[Broni]

C:\Windows\sys32\drivers\etc\hosts

Error: 0
Results = Change
Status  = Changed

Did it give you any option to proceed?

Next scan had no activity at all.

What do you mean by "no activity"?

[tpolcha]

No.  It didn't offer me any options what so ever.  I looked at it in "test results" and it just indicated that the "Status" has changed.

Activity: 

I subsequently ran another scan and it didn't identify again (no activity as a result of running a second scan). 

I performed update again upon start up today, collected todays update and the same item identified itself twice having run the scan twice.

   

[Broni]

If I understand correctly, when you run second scan with same version of AVG (not updated), it doesn't complain about "hosts" file, but if you update AVG, it complains again, right?

Can you post your "hosts" file? C:\Windows\sys32\drivers\etc\
Open it with Notepad.

[evilfantasy]

C:\Windows\sys32\drivers\etc\hosts

AVG is just reporting a change occurred. This will happen with some updates.

Nothing to worry about.

[tpolcha]

Go slow. 

First; I don't know how to find (or what they are) 'host' files to post.  I presume you mean copy and paste.

Second; the same items shows up every subsequent scan no matter how many I run, whether there was any update or not to download.

T

[Broni]

Navigate to: C:\Windows\sys32\drivers\etc\
You'll see "hosts" file there. Right click on it, click "Open with". Choose Notepad. Select All>Copy, and Paste it back here.
I assume, evilfantasy is right, but I want to make sure, there is nothing malicious in your "hosts" file.

[evilfantasy]

I'm not saying don't check the hosts files, but this question has been asked on the AVG Free Forums many times and their answer is basically the same as mine.

[tpolcha]

You see, I don't know how to navigate to C:\WIndows\sys......
Sounds like old DOS work.

Maybe in windows explorer?  I tried viewing regedit and I truly don't know what I'm looking at.

[Broni]

Maybe in windows explorer?

Yes.

[tpolcha]

Well I think I finally found it.  For some reason C & P isn't going my way so I typed the files in \etc as follows:

Hosts
lmhosts.sam
protocol
hosts.20071122-094424.backup
Networks
Services

I hope this helps clear up my concerns with why AVG continues to identify that file.